CVE-2024-26780 is a vulnerability in the Linux kernel affecting the af_unix subsystem, specifically related to the garbage collection (GC) process for out-of-band socket buffers (oob_skb). The issue arises because the list_for_each_entry_safe() macro, used to iterate over sockets during GC, is not safe when a single socket buffer (skb) is referenced by multiple sockets. Freeing such an skb within this loop can cause both the current and next sockets to be unlinked simultaneously. The unlinking uses list_del_init(), which resets the list pointers, causing the prefetched next socket pointer to form a loop. This results in an infinite loop during GC, causing a task hang. The problem was identified and reported by syzbot, a kernel fuzzing tool, which demonstrated the infinite loop and task hang scenario. The root cause is that list_for_each_entry_safe() assumes safe iteration even when elements are removed, but in this case, the removal of multiple sockets referencing the same skb breaks this assumption. The fix involves replacing the iteration with a while loop that always fetches the first socket, ensuring safe traversal and preventing infinite loops. This vulnerability affects multiple Linux kernel versions as indicated by the affected commit hashes. The vulnerability can cause kernel tasks to hang, potentially leading to denial of service conditions. The detailed kernel backtrace shows the hang occurring in the unix_gc() function during socket release operations. No known exploits are reported in the wild as of the publication date. The vulnerability does not have an assigned CVSS score but is recognized and published by the Linux project and CISA.

For European organizations, this vulnerability poses a risk primarily of denial of service (DoS) on Linux systems using affected kernel versions. Since the issue causes kernel tasks to hang during garbage collection of UNIX domain sockets, critical services relying on inter-process communication via af_unix sockets could be disrupted. This can affect servers, cloud infrastructure, and containerized environments where Linux kernels are prevalent. The impact on confidentiality and integrity is minimal as the vulnerability does not directly allow code execution or privilege escalation. However, availability degradation can affect business continuity, especially for organizations running critical applications on Linux-based systems. Enterprises using Linux in data centers, cloud platforms, or embedded devices may experience system instability or require reboots to recover from hangs. The absence of known exploits reduces immediate risk, but the vulnerability's nature means attackers could potentially trigger DoS conditions remotely or locally if they can induce socket closures. European organizations with high reliance on Linux infrastructure, such as financial institutions, telecommunications, and cloud service providers, should consider the operational impact of potential service interruptions.

1. Apply the official Linux kernel patches that address CVE-2024-26780 as soon as they become available for your distribution or kernel version. Monitor vendor advisories for backported fixes. 2. For organizations unable to immediately patch, implement monitoring to detect hung tasks or abnormal CPU usage related to unix_gc or socket release functions. 3. Limit exposure by restricting access to systems running vulnerable kernels, especially limiting untrusted local user access that could trigger socket closures. 4. Employ kernel live patching solutions where available to reduce downtime during patch deployment. 5. Review and harden inter-process communication mechanisms that rely on UNIX domain sockets to minimize unnecessary socket references and closures. 6. Test patches in staging environments to ensure stability and compatibility before production deployment. 7. Maintain updated incident response plans to quickly address potential DoS conditions caused by this vulnerability. 8. Engage with Linux distribution vendors to confirm patch availability and timelines for your specific kernel versions.